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OPTIMIZED BUBBLE UP RECEIVER 

AMR SYSTEM 
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COMPONENTS OF A UTILITY METER-READING SYSTEM," U.S. Patent Application No. 
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5 

FIELD OF THE INVENTION 
The present invention relates to automatic meter reading systems and, more particularly, 
to the communication protocol used for the endpoint to reader hop in the automatic meter 
reading system. 

10 

BACKGROUND OF THE INVENTION 
Current automatic meter reading (AMR) systems are significantly limited in the 
information that can be obtained from the meter. Generally, the AMR system comprises a reader 
and an endpoint that is interfaced to a meter. In a typical system, the endpoint obtains the 
15 consumption reading from the meter and then bubbles up every few seconds to send that 
consumption reading, via RF signal, to the reader. Alternatively, the endpoint receives a wake- 
up tone from the reader that prompts the endpoint to send the consumption reading to the reader. 
All that is obtained from this configuration is a single consumption reading from the 

* 

meter and that reading is based on what meter register the endpoint was programmed with 
20 initially at the factory. 

As such, there is a need for an AMR system that enables the user of the system to have 
more access to and more control over the information that the meter and endpoint can provide. 
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SUMMARY OF THE INVENTION 
The present invention is a data communication protocol used between an endpoint and a 
reader in an automatic meter reading (AMR) system. The communication protocol enables the 
5 reader to have a conversation with the endpoint in that the reader can tell the meter what to do, it 
can reconfigure the meter, it can tell the endpoint to reconfigure the meter, it can request a 
specific response, it can request the endpoint to reprogram certain values in both the endpoint 
and the meter, it can request that the end point get specific information from the meter, return it 
to the end point, which returns it to the reader. 

10 In the preferred embodiment of the present invention, a reader wirelessly communicates 

with both battery-powered receivers and electrically-powered receivers; each receiver being 
operably connected to a utility meter. Each battery-powered receiver has a bubble-up period of 
X seconds while each electrically-powered receiver has a bubble-up period of Y seconds. The 
reader reads the electrically-powered receivers every W minutes, however, only (Y/X)*100% of 

15 the battery-powered receivers are bubbled up during this read time. The result is a (1- 
(Y/X))*100% reduction in falsing of battery powered meters producing a great savings in battery 
life. 

On average then, the electrically-powered meters are read 1440/W times per day while 
the battery-powered meters are read only (Y/X)*( 1440/W) times per day. The read time 
20 established within the reader is continuously sequenced by +Y seconds until +X seconds from a 
nominal. At each sequenced read time, the reader bubbles up a different (Y/X)*100% of the 
battery-powered receivers with which the reader may communicate. The AMR system described 
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enables battery-powered receivers and electrically powered receivers to communicate on the 
same frequency channels with the reader. 



BRIEF DESCRIPTION OF THE DRAWINGS 
Fig. 1 depicts a radio-based automatic meter reading system that utilizes the data 
communication protocol of the present invention. 

Fig. 2 is a table containing the physical layer specifications of the reader. 

Fig. 3A is a table containing the physical layer specifications of the endpoint at data rate 

1. 

Fig. 3B is a table containing the physical layer specification of the endpoint at data rate 2. 
Fig. 4 is a table containing the physical layer specifications of the endpoint in a one-way 
AMR system. 

Fig. 5 is a diagram of a Manchester encoding structure. 

Fig. 6 is an example of a Sequence Inversion Keyed Countdown Timer. 

Fig. 7 diagrams the data packet structure. 

Fig. 8 diagrams a high power pulse data packet structure. 

Fig. 9A diagrams a two-way command and control frame. 

Fig. 9B diagrams a one-way command and control frame. 

Fig. 10 is a table containing universal command types for the data communication 
protocol of the present invention. 

Fig. 1 1 is a table containing type specific commands for the data communication protocol 
of the present invention. 
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Fig. 1 2 diagrams command 48 of the data communication protocol, Multiple Ungrouped 
Endpoint Command. 

Fig. 13 diagrams command 49 of the data communication protocol, Vector and Listen 

Frame. 

Fig. 14 diagrams command 50 of the data communication protocol, Multiple Commands 
to Individual Endpoint. 

Fig. 15 is a diagram of the channel spectrum of the system. 

Fig. 16 is an example of a timing diagram for a staged wakeup sequence for a three cell 
reuse pattern. 

Fig. 17 is an example of a three-cell cellular reuse pattern. 

Fig. 1 8 is an example of a four-cell cellular reuse pattern. 

Fig. 19 is an example of a five-cell cellular reuse pattern. 

Fig. 20 depicts mobile operation of the system over five channels. 

Fig. 21 depicts coverage rings. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
The present invention is a data communication protocol for automatic meter reading 
(AMR) systems. The protocol is designed to be flexible and expandable enabling both one-way 
and two-way meter reading in both fixed and mobile meter reading systems. 



I. System Components 
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In an AMR system 100, as depicted in Fig. 1, that is utilized with the present invention, 
the components generally include a plurality of telemetry devices including, but not limited to, 
electric meters 102, gas meters 104 and water meters 106. Each of the meters may be either 
electrically or battery powered. The system further includes a plurality of endpoints 108, 
wherein each corresponds and interfaces to a meter. Each of the endpoints 108 preferably 
incorporates a radio receiver/transmitter, e.g., the Itron, Inc. ERT. The system additionally 
includes one or more readers that may be fixed or mobile, Fig. 1 depicts: (1) a mobile hand-held 
reader 110, such as that used in the Itron Off-site meter reading system; (2) a mobile vehicle- 
equipped reader 112, such as that used in the Itron Mobile AMR system; (3) a fixed radio 
communication network 114, such as the Itron Fixed Network AMR system that utilizes the 
additional components of cell central control units (CCUs) and network control nodes (NCNs); 
and (4) a fixed micro-network system, such as the Itron MicroNetwork AMR system that utilizes 
both radio communication through concentrators and telephone communications through PSTN. 
Of course other types of readers may be used without departing from the spirit or scope of the 
invention. Further included in AMR system 100 is a head-end, host processor 118. The host 
processor 118 incorporates software that manages the collection of metering data and facilitates 
the transfer of that data to a utility or supplier billing system 120. 

The AMR system 100 and the data protocol is usable in both one-way meter reading and 
in two-way meter reading. The one-way meter reading system enables the reader to 
communicate with and command the endpoint while the two-way meter reading system enables 
the reader to communicate with and command the endpoint while also enabling the endpoint to 
respond to the reader. 
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II. System Protocol 

The present communication protocol will be described with reference to the 1430 MHz 
band that may be utilized within North America, however, it should be understood that any other 
5 radio frequency band may be used, as suitable, without departing from the spirit or scope of the 
invention. The present communication protocol will also be described with reference to the 
Open Systems Interconnection (OSI) protocol stack of the International Standards Organization 
which includes: (1) the physical layer; (2) the data link layer; (3) the network layer; (4) the 
transport layer; (5) the session layer; (6) the presentation layer; and (7) the application layer. 

10 

H.A. System Protocol - Physical Layer 

The physical layer describes the physical characteristics of the communication. This 
layer conveys the bit stream through the network at the electrical and mechanical level. It 
provides the hardware means of sending and receiving data on a carrier. The physical layer 

15 specifications for the reader may be found in Fig. 2 wherein: (1) the operational modes; (2) the 
frequency band; (3) the channel bandwidth; (4) the modulation scheme; (5) the deviation; (6) the 
encoding; (7) the bit rate; (8) the frequency stability; (9) the minimum reception sensitivity; (10) 
the transmission power; (1 1) the preamble length; and (12) the transmission modes are provided. 
The physical layer specification for the endpoint in a two-way AMR system, at a first 

20 data rate and a second data rate, are found in the tables of Fig. 3 A and Fig. 3B, respectively. The 
specifications provided include: (1) the operational modes; (2) the frequency band; (3) the 
channel bandwidth; (4) the modulation scheme; (5) the deviation; (6) the encoding; (7) the bit 
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rate; (8) the frequency stability; (9) the minimum reception sensitivity; (10) the minimum 
preamble length; and (1 1) the factory default frequency. The physical layer specification for the 
endpoint in a one-way AMR system is provided, similarly, in the table of Fig. 4. 

n.B. System Protocol - Data Link Layer 

The data link layer specifies how packets are transported over the physical layer, 
including the framing, i.e., the bit patterns that mark the start and end of packets. This layer 
provides synchronization for the physical level. It furnishes transmission protocol knowledge 
and management. In the present data communication protocol, all outbound data transmissions, 
i.e., all communications from the reader's central radio to endpoint, are Manchester encoded 
with the guaranteed transition mid-bit and each data bit encoded as a n a n (bar). (See Fig. 5 for the 
Manchester Encoding Structure). Inbound transmissions from the endpoint are either transmitted 
as Manchester encoded data, identical to outbound transmissions, or are transmitted as NRZ 
(non-return to zero) data. Selection is based on the value of the MCH flag in the command and 
control frame. 

The data link layer provides a countdown timer. The countdown timer uses Sequence 
Inversion Keying to represent timer bits. Each system is assigned a 10-bit pseudo noise (PN) 
sequence (for valid sequences, see Table 1 below). That sequence in the data stream represents a 
timer bit value 0 and the inverse of that sequence in the data stream represents a timer bit value 
1. Timer values are composed of 10 timer bits, or 100 data bits. The countdown timer begins at 
1023, or 1111111111 binary, and counts sequentially to zero, encoding all timer bits as either the 
system PN sequence or its inverse. The total counter time, in seconds, is 102400/r, where r is the 
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bit rate, in bits per second. Fig. 6 provides an example of a Sequence Inversion Keyed 
Countdown Timer. 



Table 1. PN Sequences 



Sequence 
ixumDer 


Usage 


Sequence— U 


inverted 

ocqueiiLc — i 


0 


Factory Default 


0000000010 


1111111101 


1 


Electric Devices 


0000000110 


1111111001 


2 


Electric Devices 


0000001010 


1111110101 


3 


Electric Devices 


0000001110 


1111110001 


4 


Electric Devices 


0000011010 


1111100101 


5 


Electric Devices 


0000010110 


1111101001 


6 


Electric Devices 


0000111010 


1111000101 


7 


Battery Devices 


0000101110 


1111010001 


8 


Battery Devices 


0001110110 


1110001001 


9 


Battery Devices 


0001101110 


1110010001 


10 


Battery Devices 


0000011110 


1111100001 


11 


Battery Devices 


0001011110 


1110100001 


12 


Battery Devices 


0001111010 


1110000101 



All inbound packet transmissions are preceded by a 24-bit preamble and appended with a 16-bit 
CRC code, which is inclusive of all header information, but not the preamble, length, or 
10 length_bar bytes. The CRC polynomial is 0x1021. The CRC initialization value is 0x0000. 
CRC processing is performed most significant byte (MSB) first, and the final checksum is not 
inverted. 



15 

II. C. System Protocol - Network Layer 
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The network layer specifies how packets get from the source network to the destination 
network. This layer handles the routing of the data (sending it in the right direction to the right 
destination on outgoing transmissions and receiving incoming transmissions at the packet level). 
The network layer does routing and forwarding. In the present data communication protocol, the 
network layer functionality is only implemented in electric endpoints, i.e., it is not used for 
battery-powered endpoints, or in any endpoint that acts as translator or repeater. This layer 
controls the hopping functions that need to occur between a reader and any endpoint in order to 
transfer data. This hopping protocol is currently used within the Itron AMR systems and is 
therefore not described in detail herein. 

HP. System Protocol- Transport Layer 

The transport layer is used to solve problems like reliability ("did the data reach the 
destination?") and ensure that data arrives in the correct order. This layer manages the end-to- 
end control (for example, determining whether all packets have arrived) and error-checking. It 
ensures complete data transfer. In the present data communication protocol, slotting control is 
handled in the transport layer. This includes slot assignments, timing, and any necessary 
packetization. Fig. 7 details the packet structure. The message, message type, and flags are 
received from the presentation layer, and broken into appropriately sized packets. Each packet is 
prefaced with the packet number, ID, flags, message type, and packet length. The packet length 
reflects the number of bytes in the message itself, exclusive of header information. In the case 
where more than 254 bytes are required in a packet, the value of the length field is set to OxFF, 
and the actual length of the message structure is placed in bytes 14 (high byte) and 15 (low byte), 



10 



Attorney Docket No. 1725.159US02 
with the message bytes to follow. All packets must have a whole number of bytes in the 
message. 

The packet number byte is configured as below in Table 2, wherein the first four bits 
comprise the total number of packets in this message and the last four bits comprise the packet 
5 number. 



Table 2. Packet Number 



T 


T 


T 


T 


N 


N 


N 


N 



MSB LSB 

10 

The flags byte is configured as below in Table 3. The first two bits are reserved while the 
second two bits provides the encoder number (for multi-encoder units), wherein 00 = encoder 0, 
01 = encoder 1, 10 = encoder 2, and 11 = encoder 3. The fifth bit signifies the status of a 
pending event, wherein 0 = no pending event and 1 = a pending event. The sixth bit comprises 
15 the security bit, wherein 0 = security disabled and 1 = security enable. The seventh bit comprises 
the relay bit, wherein 0 = message from originating endpoint and 1 = message via relay. The 
eighth bit comprises the resend bit, wherein 0 = first attempt at packet transmission and 1 = 
resend attempt. 

20 Table 3. Flags 



R 


R 


ENC 


ENC 


EVT 


SEC 


RLY 


RSD 



MSB LSB 



Some endpoints in the system have the option of sending out an infrequent (several times 
25 a day) fixed format message at a higher power level, for use in one-way fixed network 
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applications. The message has its own structure, as defined in Fig. 8. The custom packet is then 
BCH (255, 139, 15) encoded, prior to transmission. The encoding polynomial is 
0x461407132060175561570722730247453567445 8 . For multi-encoder endpoints this packet is 
generated and sent for each individual encoder. The flags for the high power pulse data packet 
5 structure are configured as shown in Table 4 below. The first four bits are reserved while the 
fifth and sixth bits provide the encoder number, wherein 00 = encoder 0, 01 = encoder 1, 10 = 
encoder 2, and 11 = encoder 3. The seventh bit comprises the relay bit, wherein 0 = message 
from originating endpoint and 1 = message via relay. The eighth bit comprises the error code 
indicating that a critical endpoint error has occurred. 

10 

Table 4. Flags 



R 


R 


R 


R 


ENC 


ENC 


RLY 


ERR 



MSB LSB 

15 

HE. System Protocol - Session Layer 

The session layer sets up, coordinates, and terminates conversations, exchanges, and 
dialogs between the applications at each end. It deals with session and connection coordination. 
In the present data communication protocol, the session layer generally comprises the command 
20 and control frame that is sent from the reader to the endpoint. 

n.E.i. System Protocol - Session Layer/Two- Way Command and Control 
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The command and control frame is used to issue command to two-way endpoints either 
individually or in groups. It also serves to realign the endpoint real-time clock. Fig. 9A 
diagrams the two-way communication command and control frame. As shown, the command 
and control frame transmission is preceded by a 24-bit preamble, as indicated by the three "P" 
fields within the frame. The first 16 bits are preferably an alternating pattern, AAAAh, and are 
used for clock recovery. The last 8 bits are used for frame and timing synchronization. 

Field "0" of the command and control frame comprises the system identification (ID). 
Each system is issued an 8-bit ID value, which is stored in the endpoint, to distinguish different 
systems within geographic proximity. The endpoints are designed to respond to commands from 
their own system or to commands that address them specifically by ID number, proper security 
password, and have a 0x00 in field "0". The system ID functions nearly identically to the cell 
ID, described below. However, the system ID is universal, while the cell ID is local, i.e., a single 
system will have multiple cells each having the same system ED but a different cell ED. 

Field "1" of the command control frame comprises the frame ED. Each reader within the 
system is assigned a frame ID to use based on its position in the wake-up sequence. The position 
in the wakeup sequence is directly related to the frequency reuse pattern that is used in a given 
system. Table 1 , described earlier, correlates the frame ID to the channel, which is correlated to 
the cell reuse ratio. 

Field "2" of the command and control frame comprises the cell ID. Each cell is issued an 
8-bit ID value, which is stored in the endpoint, to distinguish different systems within geographic 
proximity. 



13 



Attorney Docket No. 1725.159US02 
Fields "3" through "6" of the command and control frame is the RTC, which is defined 
as UTC time (coordinated universal time), which is a 32-bit value representing the number of 
seconds since midnight (00:00:00) on January 1, 1970 GMT. 

Field "7" is the command flags 1 field, wherein the first three bits define a slot length 
5 according to Table 5. 



TABLE 5. Slot Lengths 



Value of Length Bits 


Nominal Length in Ticks* 


Nominal Length in ms 


000 


819 


24.99390 


001 


1638 


49.98779 


010 


3277 


100.00610 


011 


6553 


199.98169 


100 


9830 


299.98780 


101 


16384 


500.00000 


110 


32768 


1000.00000 


111 


163840 


5000.00000 



*Defined as ticks of an ideal 32,768 Hz clock. 



10 The fourth bit is the forward error correction bit, wherein 0 = no forward correction error and 1= 
forward error correct all responses. The fifth bit provides the slot mode, wherein 0 = respond to 
command in pseudo-random slot (Slotted Aloha) and 1 = respond to command in the defined 
slot. The sixth bit of field "7" defines the data type, wherein 0 = NRZ response from endpoint 
and 1 = Manchester encoded from the endpoint. The seventh and eighth bits of field "7" 

15 comprise the command target, wherein 00 = the entire cell, 01 = the group defined in EPIDJHI 
(field "12"), 10 = the group defined in EPIDJLO (field "15"), and 1 1 = the endpoint defined by 
EPDD (including HI/LO), fields "12" through "15". It should be noted that in single endpoint 
communications the command target (TGT) is set to 1 1 and the endpoint responds immediately 
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after command processing with a minimum of 25 milliseconds between this frame and the 
endpoint response. 

Field "8" of the command and control frame is the command flags 2 field, wherein the 
first four bits are reserved. The fifth and sixth bits defined the encoder number, wherein 00 = 
Encoder 0, 01 = Encoder 1,10 = Encoder 2, and 11= Encoder 3. The final seventh and eighth 
bits define the transmit mode, wherein 00 = transmit mode 1, e.g., mobile response required, 01 
= transmit mode 2, e.g., fixed network response required, and 10/11 are reserved. Also see 
section V below. 

Field "9" of the command and control frame comprises the slot offset. Slot offset defines 
the number of slots between packets in multi-packet messages. For example, if the endpoint has 
an initial slot number of 50, and the slot offset is 120, a three-packet message would be 
transmitted in slots 50, 170, and 290. 

Fields "10" and "11" of the command and control frame define the first unsolicited 
message. Specifically, they define the slot number where the unsolicited messages (UMs) are to 
begin. Any UMs generated during the cell read would be reported in a pseudo-randomly 
selected slot after the slot defined here. If the value of this field is 0x0000, no UMs are sent from 
the endpoint. 

Fields "12" through "15" of the command and control frame provide the endpoint IDs for 
those endpoints that the reader is desiring to communicate with. 

Fields "16" and "17" are the security fields and are described further in relation to the 
presentation layer. 
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Field "18", defines the command set. The commands are divided into two groups: (1) 
universal and (2) type-specific. Universal commands are numbered 0-63 and are applicable to 
all the system endpoints. Type specific commands are numbered 64-255 and vary depending on 
the lower nibble of the command set field in accordance with Table 6 below. 

5 

Table 6. Command Sets 



Command Set 


CDS Value 


Usage 


0 (default) 


0000 


Utility Metering Endpoints 


1 


0001 


Repeaters and Translators 


2 


0010 


Telemetry Devices 


3-14 


0011-1110 


«Reserved» 


15 


1111 


«Reserved Engineering Use Only» 



10 Fields "19" through "21" of the command and control frame define the command and 

command body. Specifically, the eight command bits of field "19" indicate the command type, 
wherein the numbers 0-63 are universal commands and 64-255 are the type specific commands. 
Fields "20" and "21" provide sixteen bits wherein any data needed to carry out the command 
type is provided. The tables in Figs. 1 0 and 1 1 indicate the command types and command bodies 

1 5 that are possible with the system of the present invention. Referring to the universal commands 
(Fig. 10), it can be seen that the present system is capable of but not limited to: (1) reporting a 
status; (2) changing a system number to a new system number; (3) changing a group number to a 
new group number; (4) changing a system slot number to a new system slot number; (5) 
changing the cell ID to a new cell ID; (6) reporting slot numbers; (7) resending identified packets 

20 of data; (8) setting the receiver bubble-up period; (9) setting the bubble-up channel; (10) setting 
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the bubble-up time; (11) configuring the transmission power; (12) setting the channel frequency; 
etc. 

Referring to the type specific commands (Fig. 11), numerous other commands are 
available including but not limited to: (1) reporting consumption data; (2) reporting time of use 
5 (TOU) data; (3) reporting logged data; (4) reporting temperature; (5) reporting tamper data; (6) 
setting configuration flags; (7) initializing consumption; (8) reporting an event summary; (9) 
performing an endpoint diagnostic check; (10) reporting memory contents; etc. 

Fields "22" and "23" of the command and control frame designate the response 
frequency for the endpoint. The response frequency is configured as 16 bit flags, identifying 
10 valid response frequencies for the endpoint. For example, if the response frequency has a value 
of OxOOCl (bits, 7, 6, and 0 are set), the endpoint may respond on channel 7, channel 6, or 
channel 0. 

Fields "24" and "25" are reserved for later use. 

Fields "26" and "27" of the command and control frame provides the cyclic redundancy 
15 check (CRC). Specifically, fields "26" and "27" provide a 16-bit CRC. The CRC is preferably a 
polynomial defined as 0x1021. The CRC initialization value is 0x0000. CRC processing is 
performed most significant bit (MSB) first, and the final checksum is not inverted. 

HE.ii. System Protocol - Session Layer/One- Way Command and Control 
20 One-way devices use the programming frame shown in Fig. 9B. The command and 

command body bytes are similar to that described above with reference to the two-way devices. 
The byte for number of commands provides the total number of commands to follow in this 
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frame, with a maximum value of 8. The command flags are diagrammed in Table 7 below. The 
first two bits indicate the transmit mode, wherein 00 = transmit mode 0, 01 = transmit mode 1, 
and 10/11 are reserved. The third bit designates the data logging, wherein 0 = data logging is 
disabled and 1 = data logging is enabled. The fourth bit designates the forward error correction, 
5 wherein 0 = disable forward error correction on response and 1 = enable forward error correction 
on response. The fifth and sixth bits designate the mode set, wherein 00 = stock mode, 01 = test 
mode, 10 = reserved mode, and 1 1 = normal mode. The seventh and eighth bits are reserved. 

Table 7. Command Flags 

10 



TXM 


TXM 


DLG 


FEC 


MDE 


MDE 


R 


R 



MSB LSB 



n.E.iii. System Protocol - Session Layer /Special Commands - Channel Frequency 
15 Certain of the commands provided in the command and control frame are described in 

detail below. For instance, Command 33, which is the set channel frequency. Each of the 
system endpoints support up to 16 channels, which are set individually. They may or may not be 
contiguous channels. The channel numbering differs based on frequency band. For example, in 
the present implementation of the invention, the 1427 - 1432 MHz band is divided into 6.25 kHz 
20 frequency channels, with frequency channel 0 centered at 1427.000 MHz, frequency channel 1 
centered at 1427.00625 MHz, etc. If endpoint channel 15 is programmed to a value of 480, that 
endpoint receiver will always operate at 1427.000 + (.00625 * 480) = 1430.000 MHz. 

The command body of the set channel frequency command is detailed below in Table 8: 

25 

18 
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TABLE 8. Command Body/Channel Frequency 



CHN 


CHN 


CHN 


CHN 


FRQ 


FRQ 


FRQ FRQ 


FRQ 


FRQ 


FRQ 


FRQ 


FRQ 


FRQ 


FRQ 


FRQ 



MSB LSB 



5 Individual frequencies are programmed into the endpoint by selecting the channel being 
programmed (1-15) with the top nibble, and the frequency number in the lower 12 bits. Endpoint 
channel 0 is preferably the manufacturing default frequency, and may not be edited. Endpoint 
channel 15 is the receiver frequency. It is initialized to the same frequency as channel 0 at 
manufacture, and is preferably programmed prior to or at installation. The endpoint channel uses 
10 are defined in Table 9 below: 



Table 9. Endpoint Channel Use 



Endpoint Channel 


Channel Use 


0 


Factory Default. This channel is not reprogrammable. 


1 


General use Tx/Rx (Transmission/Reception) 


2 


General use Tx/Rx 


3 


General use Tx/Rx 


4 


General use Tx/Rx 


5 


General use Tx/Rx 


6 


General use Tx/Rx 


7 


General use Tx/Rx 


8 


General use Tx/Rx 


9 


General use Tx/Rx 


10 


General use Tx/Rx 


11 


General use Tx/Rx 


12 


General use Tx/Rx 


13 


General use Tx/Rx 


14 


Default UM Channel (unsolicited message) 


15 


Default Rx Channel 



15 
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The configuration flag commands, i.e., commands 90, 91, and 92 are used for setting 
individual flags in the endpoints. Each flag command includes an 8-bit flag mask and an 8-bit 



flag as shown below (the configuration flags 1 command body): 
5 Table 10. Flag Mask 



MSK 


MSK 


MSK 


MSK 


MSK 


MSK 


MSK 


MSK 
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Table 11. Flags 
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UMC 


FN 


FEC 


MMI 



The flag mask field determines which flags are to be modified by this command. A "1" in any 
bit position means the associated value in the flags field should be modified. For example, A 

15 value of 0x17 (bits 4,2,1 and 0 are high) means that the values in the Flags field, bits 4, 2, 1, and 
0 must be written to the associated flags in the endpoint. With regard to the flags field of Table 
7, the first four bits are reserved for future growth while the fifth bit, UMC, defines the 
unsolicited message channel, i.e., UMC = 0 then transmit UMs on Channel 14, and UMC = 1 
then transmit UMs on channel 15. The sixth bit of the flags field defines the fixed network 

20 mode, wherein 0 = this endpoint operates in Mobile/Handheld mode only and 1= this endpoint 
operates in mobile/handheld/fixed network mode. The seventh bit of the flags field defines the 
forward error correction, wherein 0 = no forward error correction applied to the high power pulse 
and 1 = forward error correction is applied to the high power pulse. The eighth bit of the flags 
field defines the multiple message integration, wherein 0 = no multiple message integration 

25 applied to high power pulse and 1 = multiple message integration applied to high power pulse. 
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H.E.iv. System Protocol - Session Layer/Special Commands - Test Commands 

The present data communication protocol provides at least two commands for use in 
system testing and analysis. The first command is command 210, i.e., Generate UM (unsolicited 
message). This command automatically generates an unsolicited message in all endpoints 
addressed by the command and control frame. It generates the lowest numbered UM supported 
by the endpoint. The second command is command 211, i.e., Enter Screaming Viking Mode. 
Screaming Viking Mode is a constant transmission mode, to be used for test only. When this 
command is received, the endpoint repetitively transmits its ID for the number of minutes 
declared in the command. If a value of 0 is sent, the mode is active for 15 seconds. 

H.E.v. System Protocol - Session Layer/Special Commands - Extension Commands 

Commands 48, 49 and 50 of the data communication protocol are implemented as 
extensions to the command and control frame. The extension commands immediately follow the 
command and control frame in the same transmit session. Command 48 is the multiple 
ungrouped endpoint command. In the case where the system needs to command a group of 
specific endpoints and vector them to specific slots, command 48 is issued. The central radio 
then issues commands to these endpoints, as shown in Fig. 12. This command can be used to 
address a maximum of 16 distinct endpoints. The packet length reflects the number of endpoints 
addressed by the message. Note that the command 48 may not be used for any command that 
requires the security password. The structure of command 48 provides for an 8-byte preamble 
having the value of OxAAAA AAAA AAAA AA96, the length, the endpoint IDs, and the 
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command bodies for each of the endpoints and a response byte for each of the endpoints. The 
response byte is diagrammed in Table 12 below: 



Table 12. Response Byte 
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CHN 



5 MSB LSB 



The response byte reserves the first four bits and utilizes the last four bits to define the response 
frequency nibble. Specifically, the four bit flags define which of the four default channels the 
10 endpoint may respond on. If CHN = 0000, then use the response frequency byte from the 
original command and control frame. The structure of the command 48 also includes the CRC as 
described earlier. 

Command 49, i.e., the vector and listen frame, is issued in the instance where the central 
radio or reader need to download an arbitrary block of data to the endpoint. The endpoint, upon 

15 receiving this command receives a data frame, as defined in Fig. 13. This command is valid only 
when the endpoints are individually addressed (i.e., TGT = 11). The data is endpoint-type 
specific. Note that the vector and listen frame has an 8-byte preamble with a value of OxAAAA 
AAAA AAAA AA96. Further, note that the packet length reflects the number of bytes in the 
message itself, exclusive of header information, and that the CRCs computed over all bytes in 

20 the message body. 

Command 50, the multiple command to individual endpoint command, is used in the case 
where the central radio or reader need to download a series of commands to one specific 
endpoint. The endpoint, upon receiving this command, receives a data frame as defined in Fig. 
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14. This command is only valid when the endpoints are individually addressed (i.e., TGT = 1 1). 
Up to 24 commands may be issued to an endpoint using this structure. Note that the packet 
length reflects the number of commands to be issued within this structure. 

II.F. System Protocol - Presentation Layer 

The presentation layer, which is usually part of an operating system, converts incoming 
and outgoing data from one presentation format to another and it is sometimes called the syntax 
layer. In the present data communication protocol, the presentation layer handles data security 
and any necessary data compression and decompression. 

The data security is preferably a simple two-level protocol, which may be enabled or 
disabled by the customer. Level 1 provides simple encryption for the transfer of normal data 
while level 2 provides write security to the endpoint to prevent unauthorized users from changing 
endpoint parameters. 

Level 1 is intended for use on ordinary data being transmitted from the endpoint to the 
head end. All data is encrypted with a simple 8-bit XOR mask. The level 1 security enables flag 
and encryption mask and are editable by a level 2 parameter write. The factory default for the 
XOR mask is the bottom 8 bits of the serial number. Level 1 security is applied only to the 
message itself and not to the EPID, flags, or message type. Level 1 security may be disabled by 
setting the mask value to 0. 

Level 2 security is intended for use on any head end commands to change endpoint 
parameters. It includes modification of operational, security and reprogramming parameters. 
Level 2 functionality is independent and can be applied with or without Level 1 functions 
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enabled. Each endpoint has a 16-bit password. This password is originally defined at install, 
and can be edited by a valid Level 2 command. Any write command must include the current 
password to be considered valid by the endpoint. For added security, the Level 1 encryption 
mask may be applied to the password, if Level 1 functionality is active. There is no compression 
5 performed on packet data. 

II. G. System Protocol - Application Layer 

The application layer is the layer at which communication partners are identified, quality 
of service is identified, user authentication and privacy are considered, and any constraints on 

10 data syntax are identified. (This layer is not the application itself, although some applications 
may perform application layer functions.) In the present data communication protocol, an 
endpoint application layer is used in conjunction with the application programming interface 
(API). When data is requested by the presentation layer, via the API, the application layer 
performs its processing and returns the requested message as a single block, along with one 8-bit 

15 value. The value represents the message type. 

III. System Operation 

The two-way AMR system of the present invention, at 1430 MHz, is designed to operate 
most efficiently in five contiguous RF channels. This allows the use of a cheaper (wider) 
20 receiver section in the endpoint while still maintaining the FCC mandated 50 KHz maximum 
transmit spectrum. The transmit spectrum in all devices, endpoints, and readers, must maintain a 
50 KHz or less occupied bandwidth during transmit. The receiver in the reader must also have a 
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good selectivity on the channel of interest. The endpoint receiver is allowed to accept a wider 
receive bandwidth primarily to reduce the cost of the endpoint. 

Refer to Fig. 15 to observe the 250 KHz of spectrum allocated to the system. As shown, 
the spectrum is divided in to five 50 KHz channels. The center channel, i.e., channel 3, is 
designated as the control channel for the system 100. All endpoints 106 listen on this channel. 
As such, if the readers are quasi-synchronized in their outbound transmissions the center channel 
approach allows the endpoints to use a wider receive bandwidth while avoiding the interference 
that would normally be a problem (synchronization is described in further detail below). The 
diagram of Fig. 15, illustrates the bandwidth differences graphically. Since the reader has good 
selectivity the endpoints can respond on a different channel in each cell simultaneously allowing 
the maximum data throughput in the system (cell re-use is described in further detail below). 

By utilizing an appropriate RF ASIC, e.g., the Karate RF ASIC, the architecture can be 
reduced to three contiguous channels with the reaming two or more channels scattered 
throughout the band to ease spectrum allocation requirements. With a reduction in the 
interference protection to the end point, a completely separated channel model could be used in 
an alternative configuration. However, in the separate channel model, the endpoint requires 
additional base band filtering and is still slightly more susceptible to adjacent channel 
interference on the control channel especially if operating in the high power portion of the band. 
The separate channel option also allows multiple control channels in the system when mobile 
operation is used with multiple outbound channels. When using the separate channel model, 
channels 2 and 4, of a 5-channel block, are used for control signals. 
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To alleviate cell-to-cell interference in a system with a single control channel the readers 
must be synchronized in time so that the control frames, which are described in further detail 
below, do not overlap. The addition of "dead time" in between sequential control frames allow 
for the receivers to be quasi-synchronized instead of in perfect lock step. In the preferred 
5 embodiment, quasi-synchronized means that the receivers are within 0.5 seconds of each other, 
which can easily by achieved via protocols such as NTP (network time protocol). Other quasi- 
synchronization times may be used without departing from the spirit or scope of the invention. 
As such, a GPS or other high accuracy time base is not required within the readers. 

Within the AMR system, each reader is assigned a frame ID to use based on its position 
10 in a wakeup sequence. The position in the wakeup sequence is directly related to the frequency 
reuse pattern used in a given system. The timings in the diagram of Fig. 16 are provided as an 
example of a staged wakeup sequence for three cell reuse. As shown, the timings are for an 
endpoint to endpoint clock accuracy of +/- 0.5 seconds, if the value obtainable is only +/- 1 
second then the dead time must be increased to 5 and the nominal frame time to 22.5 seconds. 
15 All other timings remain the same. If GPS is available in the reader, the dead time can be 
reduced and the time frame timing can be shortened. In any case, the minimum dead time is 
preferably 0.5 seconds. 

As shown in Fig. 16, the first wake-up sequence is initiated at time T=0. For the first 
18.5 seconds, get wakeup (SIK countdown timer), next 0.25 seconds (command and control, 
20 frame 2), and last 2.5 second is dead time. The remaining time in the timeline is the hold off 
time for response slots, which is the frame number * the nominal frame time, or 2*20 = 40 
seconds of hold off time. At T=20, the second wake-up sequence is initiated. Similarly, the first 
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18.5 seconds, get wakeup (SIK countdown timer), next 0.25 seconds (command and control, 
frame 1), and the last 2.5 seconds is dead time. The hold off time for response slots in this 
instance is, again, the frame number * the nominal frame time, which is 1 *20 = 20 seconds off 
hold off time. At T=40, the third wake-up sequence is initiated. For the first 18.5 seconds, get 
wakeup (SIK countdown time), the next 0.25 seconds (command and control, frame 0), and the 
last 2.5 seconds is dead time. The hold off time for response is calculated as follows, frame 
number * nominal frame time, or 0*20 = 0 seconds hold off time meaning the endpoints have 2.5 
seconds before the beginning of slot 0 in this cell. 

As mentioned, the example of Fig. 16 is for a three cell reuse pattern. However, the 
example can be easily extended to higher cellular reuse ratios by adding more frames as 
appropriate. In the 1430 MHz system, the maximum recommended cellular reuse is 5. This 
leads to a hold off time of 100 seconds in the first cell transmitted which is short enough for the 
endpoint to maintain accurate timing with regard to slot timings. 

Unless otherwise specified by the system, the frame ID is preferably tied to the cellular 
frequency used based on Table 13 below: 
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Table 13. Frame ID 



Cell Reuse Ratio 


Channel to Frame ID mapping 


3 Cell 


Channel 1 = Frame ID 0 
Channel 3 = Frame ID 1 
Channel 5 = Frame ID 2 


4 Cell 


Channel 1 = Frame ID 0 
Channel 2 = Frame ID 1 
Channel 4 = Frame ID 2 
Channel 5 = Frame ID 3 


5 Cell 


Channel 1 = Frame ID 0 
Channel 2 = Frame ID 1 
Channel 3 = Frame ID 2 
Channel 4 = Frame ID 3 
Channel 5 = Frame ID 4 



5 To maximize throughput in the system 100, a cellular reuse scheme is employed in the 

1430 MHz band. The reuse ratio is preferably a 3, 4, 5, 7, or 9 cell pattern. Smaller patterns are 
preferred from a delay perspective, however, the final choice is preferably made during the RF 
planning and installation of actual systems in the field. The 7 and 9 patterns are preferably used 
in the virtual cell model. The reuse patterns are provided in Figs. 17, 18, and 19 depicting three- 
1 0 cell (ABC), four-cell (ABCD), and five-cell reuse patterns (ABCDE), respectively. 



IV. Mobile and Hand-Held Operation 

When operating in the mobile or hand-held mode, the 2.5 seconds of "dead time" does 
not apply. Rather slot "0" occurs at the end of the command and control frame plus 25 
15 milliseconds. Note, that due to time required to read the attached meter and/or bring the charge 
pump to full operation the endpoint may or may not respond in slot "0" even if told to respond 
immediately. 
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In programming mode, the hand-held control may reduce its sensitivity by as much as 30 
dB to avoid overload conditions at close programming distances. The hand-held and endpoint 
must work with programming distances as close as 0.5 meters and as far as 300 meters when in 
the mobile mode of operation with a line of site propagation path. 
5 In mobile operation the wake-up sequence, the command & control data, and the receive 

portions of a standard read cycle are continuously repeated as the mobile moves through the 
system. The timing is preferably in the range of a one to five second cycle. The diagram 
depicted in Fig. 20 gives a general over view of the mobile operation over the five channels. 

The command & control frame preferably contains a group call read that solicits a 
10 consumptive type reading from all of the endpoints that can hear the mobile and that have the 
correct system ID. The endpoint responds to the group call in a random slot, on a random 
channel. The random channel is chosen from the list of available channels that is provided in the 
command & control frame. The random slot is one of the 50 ms slots in the Slotted-ALOHA 
portion of the frame. (Slotted ALOHA is a random access scheme just like regular ALOHA 
15 except that the transmissions are required to begin and end within the predefined timeslot. The 
timeslots are marked from the end of the command & control frame just like in the fixed 
network). 

When the reader hears a response from a given endpoint, it knows that it is within range 
and can request a specific response from the endpoint in the next command & control frame. 
20 The command & control frame is expected to contain both a standard command frame and an 
extended control frame to allow for the mobile to access the most endpoints possible in a single 
pass. When the mobile requests a response from the end point it will tell it the channel and time 
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slot that it is supposed to respond on. This is to minimize the chances of a collision on the longer 
messages that can be delivered in the MDP type of responses. During the mobile cycle, battery 
endpoints may be required to bubble up their receivers up at a higher rate than normal or 
synchronize to the first command & control frame to improve mobile performance. 

If the van is moving at a maximum of 30 miles per hour it will travel 440 feet in 10 
seconds. The van will also have a communications radius of approximately 500 feet give a 1400 
MHz system operating at a data rate of 22.6 Kchips/second, with the expected power levels and 
receiver sensitivities (e.g., +14 dBm endpoint TX power, -110 dBM RX sensitivity in the van, 20 
dB margin, endpoint at 5'). The margin is included because the MDP data packet is much longer 
than the current SCM type messages and is not repeated unless an error occurs. To achieve a 
low re-try rate, it is desirable to bring the BER down to 0.01%. To do this under normal 
situations would require an additional 20 dB of margin, however, a diversity setup on the van 
receivers can be used to achieve the same results. This requires two antennas on the van placed 
five to six feet apart along with an additional receiver demodulator chain per channel. For SCM 
data that is repeated multiple times, the system can operate at a much lower margin and still 
achieve excellent read reliability in the van. A coverage radius of about 1200 feet is obtained for 
the system when collecting standard consumptive data. 

The diagram of Fig. 21, shows the coverage rings for low margin SCM messages and for 
the 20 dB margin DDR messages for the present system in comparison with the current 0 dB 
margin SCM messages from the ERT. 

With the current mobile protocol each endpoint is, on average, in the range of the van for 
approximately 12 to 25 seconds. This is an appropriate amount of time to wake up the endpoint, 
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identify who it is, request an MDP (mobile data packet = 250 bytes of raw data maximum) to be 
sent, receive the MDP and potentially retry the request and receive portions of the process if 
necessary. 

In the basic system, there are five channels at a maximum 75% utilization for MDP 
responses. This gives an effective data rate of 42375 BPS or 5296 bytes per second or 21 blocks 
per second. Since the system is looking at a single block per meter, the system can support 21 
new meters per second. The mobile then has a nominal range of 500 feet. This gives the system 
of about 175 meters in range at any given time, even in the densest specified systems. If the van 
is moving at 30 mph, the system gets 44 feet of new meters per second. In performing a 
geometric approximation, the result is about 12 new meters per second. So, the system can 
handle 21 new meters per second but can only get in the range of 10 to 12 meters per second. 
This allows for a full set of retries in a dense system. (This assumes the low 11.36363 KBPS 
data rate and the full 250 byte MDP, for smaller packets and with the higher data rate option, the 
situation is even better. 

V. Bubble-Up Optimization Scheme 

* 

The basic premise of using a bubble up receiver in a two-way system to conserve battery 
life is not new. However, it has consistently been a problem to deal with falsing, i.e., waking up 
the meter when there is no desire to read the meter. Current options for dealing with falsing 
include operating on different frequencies, operating with different data rates, operating with 
different modulation techniques (and, multiple frequencies may not always be obtainable in the 
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current regulatory environment). However, each of these solutions increases the cost and 
complexity of the receivers. 

As such, the present invention presents a simple and cost effective approach to reducing 
falsing in a receive bubble up system by enabling the readers to transmit the wakeup signal for a 
5 variable amount of time. Different bubble up periods are used between the electric and battery 
powered products and variable length wakeup preambles in the reader to reduce falsing between 
the systems thus increasing the battery life of the battery-powered receivers while reducing 
overall complexity. 

The optimization scheme of the present invention requires that battery devices be set up 
10 with a bubble up period of X seconds, which is much longer than the bubble up period of the 
electric devices, Y seconds. In general, in any AMR system, the electric devices are read much 
more often than battery devices. However, the desire is not to wakeup the battery devices each 
time the electric devices are read; this is just wasted battery lift. As such the desired scenario is 
to read the electric devices every W minutes and read the battery devices every Z hours. This is 
15 a ratio of (Z*60)/W to 1 in read times which can be a significant amount of battery capacity over 
the life of the device. With the wakeup timings of Y/X of the battery devices in the system 
wakeup in each electric read cycle. The fixed network reader offsets the next sequential read 
time by +Y second which will wake up a different (Y/X)* 100% of the battery population, this 
continues until +X seconds from nominal is reached. Then, there is a loop back to 0 seconds 
20 offset and the process is started all over again. With this approach each battery device only 
wakes up on an average of (Y/X) * (1440/W) electric reads per day instead of all (1440/W) 
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reads. Basically, there is a reduced falsing by (1-(Y/X))*100% with this algorithm which is 
significant. 

An example of the optimization scheme is provided hereinbelow: The battery devices are 
set to a bubble up period of 10 seconds and the electric devices to a period of 0.5 seconds. In 
general, the system is going to read the electrics devices much more often than the battery 
devices. A typical scenario is to read the electric devices every 15 minutes and read the battery 
devices every 12 hours. This is a ratio of 48 to 1 in read times which can be a significant amount 
of battery capacity over the life of the product. With the wakeup timings outlined only 0.5/10 (or 
5%) of the battery devices in the system wakeup in each electric read cycle. The fixed network 
reader offsets the next sequential read time by +0.5 seconds which will wake up a different 5% 
of the battery population, this continues until the system reaches +10 seconds from the nominal 
at which point the system loops back to 0 seconds offset and starts the process over again. With 
the approach each battery device only wakes up on average of 4.8 electric reads per day instead 
of on all 96 reads per day. Basically, the falsing has been reduced by 95% by utilizing this 
scheme. 

Thus, the bubble-up optimization scheme described above allows a customer to have an 
optimized electric/gas or electric/water (gas and water receivers are generally battery powered) 
combination system that gives maximum battery life in the battery products, provides maximum 
flexibility and data throughput in the electric devices, all the while allowing the electric and 
battery systems to co-exist on the same frequency channels, which enables easier FCC approval 
of license applications. The present invention helps to eliminate battery consumption in receiver 



33 



Attorney Docket No. 1725.159US02 
bubble up devices due to falsing thus allowing multiple systems to operate in the same spectrum, 
e.g., combination utilities. 

The present invention may be embodied in other specific forms without departing from 
the spirit of the essential attributes thereof; therefore, the illustrated embodiment should be 
5 considered in all respects as illustrative and not restrictive, reference being made to the appended 
claims rather than to the foregoing description to indicate the scope of the invention. 
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